Use cases

How to ask your database questions in plain English with AI

To ask your database questions in plain English, you connect the database to an AI agent with read-only actions: it looks at the tables, writes the SQL query, runs it, and explains the result. Because the query runs in a read-only transaction, the agent can answer questions but cannot change your data.

Updated 13 November 2026 · 4 min read

1A question

How many customers signed up last month, by country?

2Read-only SQL

Run a read query5 rows · 38 msRead-only

SELECT country, count(*) AS signups
FROM customers
WHERE created_at >= date_trunc('month', now()) - interval '1 month'
  AND created_at < date_trunc('month', now())
GROUP BY country
ORDER BY signups DESC;

3The answer

Data analyst5 rows · 38 ms

India412
United States288
United Kingdom131
Germany97
Other214

1,142 customers signed up in October. India led with 412, then the United States with 288.

An example question: the agent writes the SQL, runs it read-only, and answers with the numbers.

How does an AI agent answer questions about your data?

It works the way an analyst new to your database would:

List the tables, to see what exists.
Describe the tables that sound relevant, to learn their columns.
Write a query for the question, and run it.
Read the result, fix the query if it went wrong, and explain the answer in words.

Ask “how many customers signed up last month, by country?” and you get the number, the breakdown and, if you want, the SQL it ran so you can check it.

Which databases can the agent query?

Directly: PostgreSQL and everything that speaks its protocol (Aurora, Cloud SQL, Azure, Neon), MySQL, MariaDB, SQL Server and Azure SQL, and MongoDB.
Over HTTPS: Snowflake, BigQuery and Supabase, among others in the databases category.

A database on a private network connects through an SSH tunnel to a bastion server, or through a SOCKS5 proxy, so it never has to be open to the internet. Connections are encrypted with TLS by default, and the server’s certificate is checked.

How do you stop the AI from changing your data?

Give the agent only the reading actions: List tables, Describe a table, Read rows and Run a read query. On SQL databases, several limits then apply to every query:

Reading words only. A query must start with SELECT, WITH, SHOW, EXPLAIN or a similar reading word, or it is refused.
A read-only transaction. On PostgreSQL, MySQL and MariaDB the query runs inside one, so the database itself refuses a write. SQL Server has no such transaction, so every word is checked and the session always rolls back.
Time and size limits. A query stops after 15 seconds and returns 200 rows unless asked for more, 1,000 at most.
A database user that can only read. Connect with one: it is the strongest limit of all.

Each SQL connector also has Run a write statement. Leave it out of the agent; if you ever add it, every call asks a person first, because it is marked as able to destroy data.

How do you set it up, step by step?

In MyDeepAgents, with PostgreSQL:

Create a database user with read access to the tables people may ask about, and nothing else.
Add a PostgreSQL connection in the console: the host, the database and that user. Choose directly, through an SSH tunnel or through a proxy.
Browse the tables in the console to check the connection sees what you expect.
Create an agent with the four reading actions.
Write the instructions: what the main tables mean, how your columns are named, which numbers people usually mean by “revenue” or “active”, and to show the SQL with each answer.
Ask it questions in the test chat, and compare its answers with ones you know.

Your team can then ask it in the team chat app, or a workflow can use it for a scheduled report.

How accurate is AI at writing SQL?

Good on clear questions over well-named tables, and less reliable when the meaning lives in people’s heads. The instructions close most of the gap: define your terms, name the tables to prefer, and give one or two example queries. Asking the agent to show its SQL lets anyone who reads SQL check the answer.

Choose a strong model for this job; see choosing a model for an AI agent.

Key points

The agent lists tables, reads their columns, writes the query, runs it and explains the result.
Queries must start with a reading word and run in a read-only transaction where the database has one.
Queries stop after 15 seconds and return at most 1,000 rows.
Private databases connect through an SSH tunnel or a SOCKS5 proxy.
A read-only database user is the strongest safeguard; connect with one.

Questions people also ask

Can the AI agent delete or change my data?

Not with the reading actions: queries must start with a reading word and run read-only. The separate action that runs writing statements always asks a person first, and you can leave it out entirely.

Does my database have to be public?

No. A private database connects through an SSH tunnel to a bastion server, or through a SOCKS5 proxy.

Is my data copied or stored by the platform?

The database is queried live each time, nothing is synced. The rows a query returns are part of that run’s record, like any other tool result.

Which databases are supported?

PostgreSQL and compatible services, MySQL, MariaDB, SQL Server and Azure SQL, and MongoDB directly, plus Snowflake, BigQuery, Supabase and others over HTTPS.